diff --git a/sys/netinet/raw_ip.c b/sys/netinet/raw_ip.c
--- a/sys/netinet/raw_ip.c
+++ b/sys/netinet/raw_ip.c
@@ -628,6 +628,14 @@
 		if (nam == NULL) {
 			m_freem(m);
 			error = ENOTCONN;
+		} else if (nam->sa_len != sizeof(struct sockaddr_in) ||
+			   ((struct sockaddr_in *)nam)->sin_family != AF_INET) {
+			/* Validate sockaddr length+family BEFORE the cast-and-
+			 * dereference below, matching rip_bind / rip_connect.
+			 * Without this, a short sendto(2) tolen causes a heap
+			 * OOB read of sin_addr.s_addr (DF-0650). */
+			m_freem(m);
+			error = EINVAL;
 		} else {
 			dst = ((struct sockaddr_in *)nam)->sin_addr.s_addr;
 			error = rip_output(m, so, dst);